#jsonwebtoken — Public Fediverse posts

JWT-Authentifizierung umgehbar: Sicherheitslücke im OpenID Connect Authenticator für Apache Tomcat

Im Rahmen eines Kundenprojekts haben IT-Sicherheitsexperten von ERNW Research eine Schwachstelle in der Bibliothek OpenID Connect Authenticator für Apache Tomcat identifiziert, die es erlaubt, die JWT-basierte Authentifizierung durch gezielt manipulierte, unsignierte Tokens zu umgehen.

https://www.all-about-security.de/jwt-authentifizierung-umgehbar-sicherheitsluecke-im-openid-connect-
authenticator-fuer-apache-tomcat/

#jwt #JSONWebToken #apache #apachetomcat #token

n8n Webhooks schützen: Basic, Header und JWT Auth erklärt

https://www.youtube.com/watch?v=DC8Ay9flaZc

#n8n #ki #automatisierung #automation #webhooks #jsonwebtoken #jwt #deutsch #tutorial

Ten Years of JSON Web Token (JWT) and Preparing for the Future

https://self-issued.info/?p=2708

#HackerNews #JSONWebToken #JWT #TenYears #TechTrends #FuturePreparation

CVE-2025-20188: Cisco Fixes 10.0-Rated Wireless Controller Flaw https://thecyberexpress.com/cisco-patches-cve-2025-20188/ #IOSXEWirelessController #WirelessLANControllers #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202520188 #JSONWebToken #CyberNews #Cisco

Here's the crate, FYI: https://github.com/JadedBlueEyes/jsonwebtoken. It's going pretty well.

Tags:
#Rust #JsonWebToken #cryptography

I implemented support for RSA-PSS padding in my #JsonWebToken crate today. I feel no closer to understanding crypto at all.

Ding, dong, the CVE is dead! :partyparrot:

The JWT nodejs "vulnerability" from December, popularised at the start of January, has been recognised as a non-issue 🫥

I'm really glad to see it gone. Hoping we get a rash of news stories to follow up on the torrent 🌊 that followed the Unit 42 blog...

I'm not sure if its removal was down to me raising an issue on the GitHub Advisory Database :omya_github: to ask for it to be removed.

#jwt #cve #errata #cve_2022_23529 #auth0 #unit42 #jsonwebtoken

Online la seconda puntata del 2023 di #NINAsec !

Si parla degli impatti di #JsonWebToken e della sua vulnerabilità, poi di #infostealers che stanno agitando le loro campagne malevole anche in Italia ⤵️

https://buttondown.email/ninasec/archive/bugs-in-jsonwebtoken-e-spyware-su-phishing-anche/

I see reports about a #JsonWebToken vulnerability (CVE-2022-23529), claiming that RCE is possible. Maybe I’m the one missing something here, but how could this possibly be exploited? Is that even a valid vulnerability report?

In order to exploit the vulnerability, someone needs to define a malicious toString function on the key object. Well, if they can do that – why do they need the library to call the function, can’t they do it themselves? They need to run JavaScript code on the server in order to create that function, meaning that the prerequisite for RCE is… 🥁​ RCE!

There seems to be the assumption here that this key object can somehow be serialized along with the function, and then the library will deserialize it from some manipulated storage. But JSON doesn’t serialize function code, and neither does any other serialization format that JavaScript code might use.

Seriously, how is that going around in the news without anybody asking: is there a single realistic scenario where this CVSS score 7.6 (as assigned by the reporter) vulnerability could be abused?

Schadcode-Lücke in JsonWebToken-Bibliothek bedroht 22.000 Software-Projekte

Aufgrund einer Sicherheitslücke in einer weitverbreiteten Bibliothek sind Open-Source-Projekte von unter anderem IBM und Microsoft verwundbar.

https://www.heise.de/news/Schadcode-Luecke-in-JsonWebToken-Bibliothek-bedroht-22-000-Software-Projekte-7454385.html?wt_mc=sm.red.ho.mastodon.mastodon.-.-

#JsonWebToken #Patch #Security #Sicherheitslücken #SoftwareBiblioheken #SupplyChainAttack #Update

#jsonwebtoken High Severity Security #Vulnerability Found in "jsonwebtoken" #NPM Library (CVE-2022-23529). Attackers could achieve remote code execution (RCE) on a server verifying a maliciously crafted #JWT request. Update jsonwebtoken package to v9.0.0: https://thehackernews.com/2023/01/critical-security-flaw-found-in.html

JSON Web Token (JSON Web Encryption) Authentication with Kirby CMS 3 - In yet another recent project, I’m building a book proposal submission... https://blog.mhgbrown.is/posts/8b72bbdf90640d2cc4c60be189c43e353f766e18 #Dev #Kirby3 #Authentification #JSONWebToken by @[email protected]